RT-AC68U - MAC filter not working

[fishface]

RT-AC68U FW384.15

I have the AC68 configured in AP mode, fed from AX3000.

I have a guest network configured on the AC68 and the MAC filter set to ACCEPT and populated with my kids devices, all seems normal, however, when I connect my own laptop to the guest network, which is not in the accept list, it connects fine and can browse the web - I assume this is not how this should work? I rebooted the AC68 to if you needed to do that to make the setting "stick" but it made no difference.

Also, under Advanced Setting > Wireless, there is another Wireless Mac Filter list - hows does this interact with the above Guest MAC filter? Which one should I use?

 

[eibgrad]

When configuring MAC filters under Advanced Settings->Wireless, you are configuring the *physical* wireless network adapters, either wl0 (2.4GHz) or wl1 (5GHz). And those physical wireless adapters are bridged to the private network (br0) w/ your chosen IP network (e.g., 192.168.1.0/24).

However, when you configure MAC filters under the Guest network, you're configuring a *virtual* wireless network adapter (VAP), either wl0.1 (2.4GHz) or wl1.1 (5GHz). And those VAPs are assigned to a *new* bridge (br1) w/ its own IP network (e.g., 192.168.101.0/24).

For each additional Guest network, the process repeats.

What all that means is, the private and guest networks all have their own independent MAC filtering, for each radio (2.4GHz and 5GHz). So you can end up managing a lot of MAC lists (potentially eight) depending on how many Guest networks you create and decide to use MAC filtering.

Now whether all this works correctly, well…, that's another story (I assume it does). I'm just explaining what's happening behind the scenes.

 

[fishface]

I'm keeping you busy today!

Great explanation, and gives me a better understanding.

I set the guest network a few days ago, the weird thing is this, after activating it, I immediately had all the kids wailing at me, as expected, I then added their MAC addresses, and then they could access everything, so worked just as one would expect.

This morning I noticed that one of my kids friends phone was connected to the guest network, even though their MAC address wasn't in the list, and could see they were downloading about 500Kb/s, so not much, but still surprised me, as the MAC blocking appeared to be working a few days ago.

So, for giggles, I tried to connect by own laptop, which isn't in the list, and that work fine as well, so it appears it initially worked, but now doesn't.

Tomorrow I'm re-configuring the from AP mode to router mode as per your excellent suggestion in another thread, it will give me more options.